#VU102283 Input validation error in Linux kernel - CVE-2024-56622

Vulnerability identifier: #VU102283

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56622

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the read_req_latency_avg_show() and write_req_latency_avg_show() functions in drivers/ufs/core/ufs-sysfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/0069928727c2e95ca26c738fbe6e4b241aeaaf08
https://git.kernel.org/stable/c/7b21233e5f72d10f08310689f993c1dbdfde9f2c
https://git.kernel.org/stable/c/87bf3ea841a5d77beae6bb85af36b2b3848407ee
https://git.kernel.org/stable/c/9c191055c7abea4912fdb83cb9b261732b25a0c8
https://git.kernel.org/stable/c/eb48e9fc0028bed94a40a9352d065909f19e333c

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.